End-to-end encryption Delete problem

vschwaberow · February 16, 2024, 5:50am

Support intro

I can’t delete several files, nor edit / move them

OCA\DAV\Connector\Sabre\Exception\Forbidden: Write access to end-to-end encrypted folder requires token - no token sent

/var/www/html/custom_apps/end_to_end_encryption/lib/Connector/Sabre/LockPlugin.php - line 143:OCA\EndToEndEncryption\Connector\Sabre\LockPlugin->verifyTokenOnWriteAccess([ "OCA\DAV\ … "], null)
/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php - line 89:OCA\EndToEndEncryption\Connector\Sabre\LockPlugin->checkLock([ “Sabre\HTTP\Request”], [ “Sabre\HTTP\Response”])
/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php - line 456:Sabre\DAV\Server->emit(“beforeMethod:DELETE”, [ [ "Sabre\ … ]])
/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php - line 253:Sabre\DAV\Server->invokeMethod([ “Sabre\HTTP\Request”], [ “Sabre\HTTP\Response”])
/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php - line 321:Sabre\DAV\Server->start()
/var/www/html/apps/dav/lib/Server.php - line 365:Sabre\DAV\Server->exec()
/var/www/html/apps/dav/appinfo/v2/remote.php - line 35:OCA\DAV\Server->exec()
/var/www/html/remote.php - line 172:require_once(“/var/www/ht … p”)

Nextcloud version (eg, 20.0.5): AIO
Operating system and version (eg, Ubuntu 20.04): ArchLinux with Docker
Apache or nginx version (eg, Apache 2.4.25): Nextcloud AIO
PHP version (eg, 7.4): Nextcloud AIO

jtr · February 16, 2024, 5:15pm

Where/what are you trying to delete them from? What client are you using? (And what version of the client)?

vschwaberow · February 17, 2024, 5:53am

I am using nextcloud-client 2:3.12.0-1 under ArchLinux and am trying to delete a file in Dolphin Filemanager. The client is correctly paired with the E2EE passphrase. Deletion/moving/editing fails. However, files can be opened. Is there a possibility that some files are not encrypted and this mixed environment is causing problems?

e-raser · March 4, 2024, 11:42pm

I’m seeing the very same issue (again).

[webdav] Fehler: OCA\DAV\Connector\Sabre\Exception\Forbidden: Write access to end-to-end encrypted folder requires token - no token sent at <<closure>>

0. /var/www/nextcloud/apps/end_to_end_encryption/lib/Connector/Sabre/LockPlugin.php line 143
   OCA\EndToEndEncryption\Connector\Sabre\LockPlugin->verifyTokenOnWriteAccess()
1. /var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php line 89
   OCA\EndToEndEncryption\Connector\Sabre\LockPlugin->checkLock()
2. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 456
   Sabre\DAV\Server->emit()
3. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 253
   Sabre\DAV\Server->invokeMethod()
4. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 321
   Sabre\DAV\Server->start()
5. /var/www/nextcloud/apps/dav/lib/Server.php line 368
   Sabre\DAV\Server->exec()
6. /var/www/nextcloud/apps/dav/appinfo/v2/remote.php line 35
   OCA\DAV\Server->exec()
7. /var/www/nextcloud/remote.php line 172
   require_once("/var/www/nextcl ... p")

DELETE /remote.php/dav/files/username/encrypted_folder/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
from xxx.xxx.xxx.xxx by username at 2024-03-05T00:35:32+01:00

It’s so annoying that E2EE just breaks every few days. SO annoying!

NC v27.1.7.2, Windows endpoint. Same happens for Android. iOS impossible to test because broken anyway ("Server E2EE version 1.2, not compatible" plus "serious internal error in end-to-end encryption" · Issue #2809 · nextcloud/ios · GitHub). I start to feel no one in the E2EE business really knows what’s going on and what they are doing.

Edit: see

github.com/nextcloud/end_to_end_encryption

"Write access to end-to-end encrypted folder requires token" out of nowhere

opened 12:01AM - 05 Mar 24 UTC

bcutter

0. Needs triage bug

### How to use GitHub * Please use the 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to show that you are affected by the same issue. * Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue. ### Steps to reproduce 1. Use E2EE 2. Delete single files ### Expected behaviour Files are deleted on the server ### Actual behaviour Client complains about "403 Forbidden ..." and server logs errors ### Server configuration **Operating system:** Raspberry Pi OS **Web server:** nginx **Database:** MariaDB **PHP version:** 8.2 **Nextcloud version:** 27.1.7.2 **Updated from an older Nextcloud/ownCloud or fresh install:** Updated **Where did you install Nextcloud from:** archive, bare metal **Signing status:** <details> <summary>Signing status</summary> ``` Login as admin user into your Nextcloud and access http://example.com/index.php/settings/integrity/failed paste the results here. ``` </details> **List of activated apps:** <details> <summary>App list</summary> ``` End-to-End-Encryption app: 1.13.1 ``` </details> **Nextcloud configuration:** <details> <summary>Config report</summary> ``` If you have access to your command line run e.g.: sudo -u www-data php occ config:list system from within your Nextcloud installation folder or Insert your config.php content here. Make sure to remove all sensitive content such as passwords. (e.g. database password, passwordsalt, secret, smtp password, …) ``` </details> **Are you using external storage, if yes which one:** local **Are you using encryption:** no (only what's needed for E2EE so server-side encryption is likely used) **Are you using an external user-backend, if yes which one:** no ### Client configuration **Browser:** irrelevant **Operating system:** irrelevant, multiple clients ### Logs #### Web server error log <details> <summary>Web server error log</summary> ``` Insert your webserver log here ``` </details> #### Nextcloud log (data/nextcloud.log) <details> <summary>Nextcloud log</summary> ``` [webdav] Fehler: OCA\DAV\Connector\Sabre\Exception\Forbidden: Write access to end-to-end encrypted folder requires token - no token sent at <<closure>> 0. /var/www/nextcloud/apps/end_to_end_encryption/lib/Connector/Sabre/LockPlugin.php line 143 OCA\EndToEndEncryption\Connector\Sabre\LockPlugin->verifyTokenOnWriteAccess() 1. /var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php line 89 OCA\EndToEndEncryption\Connector\Sabre\LockPlugin->checkLock() 2. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 456 Sabre\DAV\Server->emit() 3. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 253 Sabre\DAV\Server->invokeMethod() 4. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 321 Sabre\DAV\Server->start() 5. /var/www/nextcloud/apps/dav/lib/Server.php line 368 Sabre\DAV\Server->exec() 6. /var/www/nextcloud/apps/dav/appinfo/v2/remote.php line 35 OCA\DAV\Server->exec() 7. /var/www/nextcloud/remote.php line 172 require_once("/var/www/nextcl ... p") DELETE /remote.php/dav/files/username/encrypted_folder/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX from xxx.xxx.xxx.xxx by username at 2024-03-05T00:35:32+01:00 ``` </details> #### Browser log <details> <summary>Browser log</summary> ``` Insert your browser log here, this could for example include: a) The javascript console log b) The network log c) ... ``` </details> Seen this before here: - https://help.nextcloud.com/t/end-to-end-encryption-delete-problem/181912/3 - https://github.com/nextcloud/end_to_end_encryption/issues/197 Happens for Windows desktop as well as Android desktop. iOS can not be tested as E2EE is just completely broken there currently (https://github.com/nextcloud/ios/issues/2809, which is a follow-up of https://github.com/nextcloud/desktop/issues/5918#issuecomment-1962958510, which is a follow-up of https://github.com/nextcloud/desktop/issues/5564 ...). I will try to reset E2EE using `/settings/user/security` (once again) now... but this needs to stop. E2EE is so annoying unreliable and breaks on a regular occasion, rendering it the most unreliable part of Nextcloud by far.

vschwaberow · March 6, 2024, 4:27am

They don’t want to address it in an issue and sent me here

e-raser · March 8, 2024, 12:12pm

Well there are plenty of issues for this. Check the previous posts.

Unfortunately… E2EE has not much activity on GitHub.

I reset E2EE (and also disabled the default encryption module) which somehow made it work again for Windows endpoints, at least. Let’s see when it breaks again. Probably not a matter of if, more of when.